Project

General

Custom queries

Profile

Actions

Bug #20836

closed

Safe mode rendering does not correctly prevent using symbol to proc calls

Added by Marek Hulán over 7 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
High
Assignee:
Category:
-
Target version:
Difficulty:
Triaged:
Fixed in Releases:
Found in Releases:

Description

Using methods such as `.each`, a user can pass as an argument a symbol to be called, for example `.each(&:delete)`.
This allows execution of commands that should be blocked by the jail.
A fix proposal in the safemode gem has been suggested: https://github.com/svenfuchs/safemode/pull/23
Once it is merged we should update our version of the gem to the latest one.

All of the above already happened, templates must be updated in order to work with the safemode gem version 1.3.2+, I think this should be cherry-picked to 3.4-stable


Related issues 3 (0 open3 closed)

Has duplicate Katello - Bug #20753: After upgrade to latest version katello 3.4.5 the default templates still broken RejectedJustin Sherrill08/28/2017Actions
Has duplicate Katello - Bug #21406: Remove to_proc syntax from Katello Kickstart DefaultDuplicate10/20/2017Actions
Copied from Foreman - Bug #20271: Safe mode rendering does not correctly prevent using symbol to proc callsClosedTomer Brisker07/11/2017Actions
#1

Updated by Marek Hulán over 7 years ago

  • Copied from Bug #20271: Safe mode rendering does not correctly prevent using symbol to proc calls added
#2

Updated by The Foreman Bot over 7 years ago

  • Pull request https://github.com/Katello/katello/pull/6931 added
#3

Updated by Justin Sherrill over 7 years ago

  • Has duplicate Bug #20753: After upgrade to latest version katello 3.4.5 the default templates still broken added
#15

Updated by Justin Sherrill over 7 years ago

  • Has duplicate Bug #21406: Remove to_proc syntax from Katello Kickstart Default added
Actions

Also available in: Atom PDF